Security

Why the default app is launcher for a new user?

ddrillic
Ultra Champion

A user by the name Greg belongs to an ldap group which is mapped successfully to a role and this role is mapped to a new app in user-prefs.conf. However, the user shows having launcher as his default app. How can I debug it?

0 Karma

woodcock
Esteemed Legend

Users may override the default app and this private settings store in his $SPLUNK_HOME/etc/apps/user/<someUserName>/ directory is hard to find. He may not have realized that he changed/saved this.

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

I'll start with btool first for user-prefs.conf with below command

$SPLUNK_HOME/bin/splunk cmd btool user-prefs list --debug

Above command will display role mapping with application.

Below command will display user specific settings if user overwrote his/her default app.

$SPLUNK_HOME/bin/splunk cmd btool user-prefs list --debug --user=<USERNAME> --app=user-prefs

and search for default_namespace parameter.

Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...